Sending Logstash's logs to /etc/logstash-5.2.2/logs which is now configured via log4j2.properties
[2017-07-05T16:05:43,638][ERROR][logstash.plugins.registry] Problems loading a plugin with {:type=>"filter", :name=>"multiline", :path=>"logstash/filters/multiline", :error_message=>"NameError", :error_class=>NameError, :error_backtrace=>["/etc/logstash-5.2.2/logstash-core/lib/logstash/plugins/registry.rb:221:in namespace_lookup'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/plugins/registry.rb:157:inlegacy_lookup'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/plugins/registry.rb:133:in lookup'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/plugins/registry.rb:175:inlookup_pipeline_plugin'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/plugin.rb:129:in lookup'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:95:inplugin'", "(eval):12:in initialize'", "org/jruby/RubyKernel.java:1079:ineval'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:65:in initialize'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/pipeline.rb:144:ininitialize'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/agent.rb:275:in create_pipeline'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/agent.rb:95:inregister_pipeline'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/runner.rb:264:in execute'", "/etc/logstash-5.2.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:67:inrun'", "/etc/logstash-5.2.2/logstash-core/lib/logstash/runner.rb:183:in run'", "/etc/logstash-5.2.2/vendor/bundle/jruby/1.9/gems/clamp-0.6.5/lib/clamp/command.rb:132:inrun'", "/etc/logstash-5.2.2/lib/bootstrap/environment.rb:71:in `(root)'"]}
[2017-07-05T16:05:43,662][ERROR][logstash.agent ] Cannot load an invalid configuration {:reason=>"Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: Problems loading the requested plugin named multiline of type filter. Error: NameError NameError"}
How do I place multiline inside filter function properly, but not in input function ?
Well, my configuration works and yours doesn't. I suggest you transform your configuration to my configuration step by step until the [beat][version] field disappears. Start with the multiline filter.
And, I repeat, do not use the multiline filter. At all. Use Filebeat's multiline feature instead.
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.